I have three Cisco 1700 series VPN routers at three different different locations.
Location1 Location2 Location3
Cisco 1712 <---VPN Tunnel---> Cisco 1712 <--VPN Tunnel--->Cisco 1710
10.27.2.x/24 10.24.1.x/24 10.24.99.x/24
Traffic from location 1 on the 10.27.2.x/24 subnet can communicate with Location2 on 10.24.1.x/24 both ways no problem.
Traffic from Location 2 on the 10.24.1.x/24 subnet can communicate with Location3 on 10.24.99.x/24 both ways no problem.
My problem is specifying in the ip route table on the routers in Location1 and 3 the next hop to enable traffic from location1 destined for location3 to pass
through location2.
For example I would have expected to be able to issue on the location3 router ip route 10.27.2.0 255.255.255.0 10.24.1.25 - but this is not added to the
route table.
The route table on location3's router is:-
Gateway of last resort is 84.92.xx.xx to network 0.0.0.0
84.0.0.0/29 is subnetted, 1 subnets
C 84.92.xx.xx is directly connected, Ethernet0
10.0.0.0/24 is subnetted, 1 subnets
C 10.24.99.0 is directly connected, FastEthernet0
S* 0.0.0.0/0 [1/0] via 84.92.xx.xx
I can't seem to find any way to use the VPN tunnel. The interesting thing is Ping's and Traceroutes from the routers themselves don't seem to recognise the
VPN tunnels even exist (they always go out on the default gateway) even though clients on each subnet can communicate quite happily with the network
immediately connected through each tunnel no problem.
In the current config I know I could simply create a tunnel directly between locations1 and 3 - but this is not really solving the issue as in a more complex
scenario where there are further routers at each location behind the VPN routers I will still need to specify a next hop which is through a tunnel - Which is
actually the problem I'm trying to solve.
I've included the config from location3 which is actually the router I've got setup at home to test with.
So any ideas on how to force into the routing table a next hop which is actually a router connected through the VPN tunnel?
When debug is switched on I've noticed the router attempt to add the route and then mention words to the effect it is erasing it.
If further info is required then let me know.
I've been pulling my hair out and trawling the web for ages trying to solve this little mystery to no avail!
Cheers
Roly.
!
version 12.2
service timestamps debug uptime
service timestamps log uptime
service password-encryption
!
hostname treenet1710
!
enable password 7 xxxxxxxxxxxx
!
memory-size iomem 25
ip subnet-zero
!
!
no ip domain-lookup
!
ip audit notify log
ip audit po max-events 100
ip ssh time-out 120
ip ssh authentication-retries 3
!
crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key xxxxxxxxx address 80.229.xx.xx
!
!
crypto ipsec transform-set cm-transformset-1 ah-md5-hmac esp-3des
!
crypto map cm-cryptomap local-address Ethernet0
crypto map cm-cryptomap 1 ipsec-isakmp
set peer 80.229.xx.xx
set transform-set cm-transformset-1
match address 100
!
!
!
!
interface Ethernet0
description connected to Internet
ip address 84.92.xx.xx 255.255.255.248
ip nat outside
no ip route-cache
no ip mroute-cache
half-duplex
crypto map cm-cryptomap
!
interface FastEthernet0
description connected to EthernetLAN
ip address 10.24.99.9 255.255.255.0
ip nat inside
speed auto
!
router rip
version 2
passive-interface Ethernet0
network 10.0.0.0
no auto-summary
!
ip nat inside source route-map nonat interface Ethernet0 overload
ip nat inside source static tcp 10.24.99.11 80 84.92.xx.xx 80 extendable
ip nat inside source static tcp 10.24.99.11 1600 84.92.xx.xx 1600 extendable
ip classless
ip route 0.0.0.0 0.0.0.0 84.92.xx.xx
ip route 10.27.2.0 255.255.255.0 10.24.1.25
no ip http server
ip pim bidir-enable
!
!
access-list 100 permit ip 10.24.99.0 0.0.0.255 10.24.1.0 0.0.0.255
access-list 101 deny ip 10.0.0.0 0.255.255.255 10.0.0.0 0.255.255.255
access-list 101 permit ip any any
!
route-map nonat permit 10
match ip address 101
!
snmp-server community public RO
!
line con 0
exec-timeout 0 0
password 7 xxxxxxxxx
login
line aux 0
line vty 0 4
password 7 xxxxxxxx
login
!
end
